CVE-2021-23368: Regular Expression Denial of Service in postcss

postcss Updated 02 Oct 2025

Summary

10/05/2021

Disclosed on

CVE-2021-23368

CVE

Yes i

Fix available

Moderate

Severity

5.3

CVSS Score

CVE-2021-23368: Regular Expression Denial of Service in postcss. Affects postcss across 2 version ranges.

>= 7.0.0, < 7.0.36 >= 8.0.0, < 8.2.10

Fixed in 7.0.36 or 8.2.10, depending on the release line you run. How to fix ↓

Also tracked for

node-postcss · Debian:11

The same CVE-2021-23368 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

PostCSS is an open-source tool for transforming CSS with JavaScript. It is widely used in web development to process and optimize CSS files. The vulnerable version of the postcss package, specifically versions 7.0.0 to 7.0.36 and 8.0.0 to 8.2.10, is susceptible to a Regular Expression Denial of Service (ReDoS) during source map parsing. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) by sending specially crafted source map files.

Vulnerability Detail

The vulnerability arises due to inefficient regular expressions used in the source map parsing functionality of the postcss package. An attacker can send a malicious source map file containing a specially crafted regular expression that triggers a ReDoS attack. This can lead to excessive CPU usage and cause the application to become unresponsive or crash. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.

How To Fix

Latest published version: 8.5.31 as of 22 Oct 2026

npm install postcss@8.5.31

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 7.0.0, < 7.0.36 7.0.36
```
npm install postcss@7.0.36
```
>= 8.0.0, < 8.2.10 8.2.10
```
npm install postcss@8.2.10
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a temporary workaround, if upgrading the package is not immediately feasible, developers can consider disabling the source map parsing functionality in the postcss configuration. This can be achieved by removing or commenting out the relevant configuration options related to source maps. However, this workaround may impact the ability to generate or utilize source maps in the CSS processing pipeline.

Conclusion

The postcss package versions 7.0.0 to 7.0.36 and 8.0.0 to 8.2.10 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack during source map parsing. This can result in a denial of service (DoS) condition where the application becomes unresponsive or crashes. It is crucial to upgrade to the latest version of the package to mitigate this vulnerability. If immediate upgrading is not possible, disabling the source map parsing functionality can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for postcss →

FAQ

What is the impact of this vulnerability?

The vulnerability can be exploited by an attacker to cause a denial of service (DoS) by sending specially crafted source map files. This can lead to excessive CPU usage and cause the application to become unresponsive or crash.

How can I check if my application is affected?

You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for open-source vulnerabilities, including this specific vulnerability.

What is a Regular Expression Denial of Service (ReDoS) attack?

A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that exploits inefficient regular expressions. By providing a specially crafted input, an attacker can cause the regular expression matching algorithm to exhibit exponential time complexity, leading to excessive CPU usage and potential denial of service.

Are there any known mitigations for this vulnerability?

The primary mitigation for this vulnerability is to upgrade to the latest version of the postcss package. Additionally, disabling the source map parsing functionality can serve as a temporary workaround until the package can be updated.